Privacy Policy

1. Who we are

ClauseCheck is an AI-powered contract analysis service operated as a sole trader / small business based in the United Kingdom. References to "we", "us", or "our" mean ClauseCheck. Our contact email is akandebolu97@gmail.com.

This policy explains how we collect, use, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What data we collect

• Account data: Your email address and name when you create an account (handled by Clerk, our authentication provider).
• Contract text: The contract content you submit for analysis. This is transmitted securely to Anthropic's Claude API and is not stored by ClauseCheck after your session ends.
• Payment data: Billing details for paid subscriptions are handled entirely by Stripe. We never see or store your card number.
• Usage data: A record of each scan you run (date, contract type, jurisdiction, length and risk score, but never the contract text) so we can enforce plan limits and show your history.
• Firm data: If you use ClauseCheck for Firms: which firm you belong to and your role; the names of matters, who is on each matter's team and which clients were invited; and the email addresses of people invited (kept so an invitation can only be accepted by that person).
• Security data: A log of account activity (for example, when a scan starts, finishes or is blocked) for security and abuse prevention. We do not store your IP address itself; we store a scrambled fingerprint of it that cannot be turned back into the address.

3. How we use your data

• To provide and improve the contract analysis service.
• To manage your account and subscription.
• To enforce plan limits and prevent abuse.
• To respond to support queries.
• To comply with legal obligations.

Our lawful basis is contract performance (providing the service you signed up for) and legitimate interests (security and fraud prevention).

4. Contract text and AI processing

When you submit a contract for analysis, the text is sent to Anthropic (the maker of the Claude AI). Anthropic processes it solely to return the analysis result and does not use your contract text to train its models under the API terms. We do not retain your contract text after the analysis is complete.

Do not upload contracts that contain highly sensitive personal data (e.g. medical records, financial details of third parties) unless you are authorised to do so.

5. Third-party processors

• Clerk (authentication) - servers in the US, covered by Standard Contractual Clauses.
• Anthropic (AI analysis) - servers in the US, covered by their API Data Processing Agreement.
• Stripe (payments) - covered by Stripe's Privacy Policy and PCI DSS compliance.
• Vercel (hosting) - our servers run in London; covered by their Data Processing Addendum.
• Resend (email) - sends invitation emails on our behalf; it receives the invitee's email address, the inviter's name and the firm or matter name. Covered by their Data Processing Addendum.
• Neon (database) - stores scan records, firm memberships, invitations and the activity log in London; covered by their Data Processing Agreement.

6. Your rights

Under UK GDPR you have the right to: access your data, correct inaccurate data, request deletion, restrict processing, and data portability. To exercise any of these rights, email us at akandebolu97@gmail.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. Cookies

We use only essential cookies required for authentication (set by Clerk). We do not use advertising or tracking cookies.

8. Data retention

Account data and scan records are retained for as long as your account is active. If you delete your account, your account data and scan records are removed. Short-lived rate-limit counters are deleted within 2 days. The security activity log is kept as a tamper-evident record and refers to accounts only by an internal ID.

9. Changes to this policy

We may update this policy from time to time. We will notify registered users by email of any material changes. Continued use of the service after changes constitutes acceptance.

10. Contact

For any privacy-related questions, contact us at akandebolu97@gmail.com.